US Food Safety Modernization Act: What Online Food Businesses Must Know

The Food Safety Modernization Act (FSMA), signed in 2011 and progressively implemented through the 2010s, shifted US food safety regulation from response to prevention. For online food businesses, understanding which FSMA rules apply to your operation is a compliance essential.

The Core FSMA Rules

Preventive Controls for Human Food: Requires food manufacturing facilities to have a written food safety plan including hazard analysis and preventive controls. Applies to most food manufacturers above the small business threshold.

Produce Safety Rule: Applies to farms growing produce for human consumption. Sets standards for agricultural water, biological soil amendments, and worker health and hygiene.

Foreign Supplier Verification Program (FSVP): Requires US importers to verify that foreign food suppliers are producing food in accordance with US safety standards.

Sanitary Transportation Rule: Sets standards for carriers and shippers transporting human food.

Small Business Exemptions

FSMA includes qualified exemptions for very small businesses. The Preventive Controls rule exempts facilities with less than $1 million in average annual sales of human food (adjusted annually). However, these facilities must still provide certain product tracing information.

What This Means for Online Food Businesses

An online food business making food at home or in a registered commercial kitchen and selling to consumers should understand: do you meet the registration threshold? Do you need a written food safety plan? Is your cold chain compliant with the sanitary transportation rule?

Registering Your Food Facility With the FDA

If your online food business operates from a facility that manufactures, processes, packs, or holds food for consumption in the United States, you are likely required to register that facility with the FDA under the Bioterrorism Act, which FSMA reinforced and expanded. Registration must be renewed every two years during even-numbered years between October 1 and December 31. Failure to register can result in serious enforcement action, including the possibility of the FDA refusing to receive or review your food for import. Even if your volumes are modest, registration is a foundational step that many new food entrepreneurs overlook until they are already shipping.

The registration process itself is completed through the FDA's online portal and requires basic information about your facility, the types of food products you handle, and the name of a US agent if your facility is located outside the country. Once registered, you receive a unique facility registration number, which you may be required to disclose to the FDA upon request or include in certain regulatory communications. If you sell across multiple fulfillment locations or use a co-packer, each distinct facility involved in manufacturing or processing your product may need its own separate registration, so it is worth auditing your supply chain carefully before assuming a single registration covers your full operation.

For very small operators selling exclusively direct to consumers within the same state under cottage food laws, FDA facility registration may not apply. However, the moment you begin shipping products across state lines through an e-commerce platform, the regulatory picture changes significantly. Online food businesses built on Shopify are inherently interstate commerce platforms by design, meaning that a product listed on your store can be purchased by a consumer in any US state within seconds. This interstate dimension is precisely why FSMA compliance cannot be treated as optional for online sellers, even those operating at relatively small volumes.

Building a Written Food Safety Plan

For food businesses that do fall under the Preventive Controls for Human Food rule, the written food safety plan is the centrepiece of FSMA compliance. This document must include a hazard analysis identifying known or reasonably foreseeable biological, chemical, and physical hazards associated with each of your food products. From that hazard analysis, you identify which hazards require a preventive control, meaning a step or procedure in your process specifically designed to significantly minimise or prevent the hazard from occurring. The FDA provides extensive guidance on what constitutes an adequate hazard analysis, and many state extension services offer free templates and workshops for smaller food businesses working through this process for the first time.

Preventive controls themselves fall into several categories: process controls such as cooking temperature steps, allergen controls that prevent cross-contact and ensure correct labelling, sanitation controls that address environmental pathogens, and supply chain controls for ingredients sourced from suppliers you rely on to control a hazard. Each control must be accompanied by monitoring procedures, corrective action plans, and verification activities. For an online food business producing baked goods, confectionery, or packaged snacks, allergen controls are particularly critical given that the major food allergens regulated under FALCPA must be clearly declared on every product label without exception.

The food safety plan must also include a recall plan, which is a written procedure describing how your business would identify, retrieve, and dispose of affected product in the event of a safety issue. For an online business, this means being able to trace which customers received which batches of product, which requires solid order record-keeping. Many Shopify merchants find that maintaining clear batch codes linked to order data is one of the most practical ways to satisfy both the recall plan requirement and the FDA's broader traceability expectations. Investing time in building these systems early, before a problem occurs, is far less costly than trying to reconstruct records during an actual recall event.

FSMA Traceability and the Food Traceability Rule

In 2022, the FDA finalised the Food Traceability Rule under FSMA Section 204, establishing enhanced traceability recordkeeping requirements for certain high-risk foods listed on the Food Traceability List. This list includes foods such as fresh leafy greens, shell eggs, nut butters, and certain fresh herbs and ready-to-eat deli salads. If your online food business handles any foods on this list, you are required to maintain Key Data Elements at Critical Tracking Events throughout your supply chain, including growing, receiving, transforming, creating, and shipping steps. Compliance deadlines for this rule apply to businesses of most sizes, with January 2026 set as the primary compliance date.

For online food businesses using Shopify, the traceability rule has direct practical implications for how you manage your ingredient sourcing records and lot coding systems. You are required to be able to provide the FDA with your traceability records within 24 hours of a request, or within a reasonable timeframe agreed upon with the agency. This means that maintaining records in spreadsheets buried across multiple folders, or relying solely on paper-based systems, creates real operational risk. Building a simple but consistent digital traceability system linked to your product listings and order fulfilment process is one of the most straightforward ways to reduce exposure under this rule.

It is worth noting that the traceability rule applies to the food itself regardless of the sales channel through which it is sold. Selling directly to consumers via your Shopify store does not exempt you from traceability requirements if you handle a food on the Food Traceability List. The FDA's position is that direct-to-consumer online sellers are part of the food supply chain and therefore subject to the same traceability obligations as any other entity that receives, transforms, or ships covered food. Reviewing the current Food Traceability List on the FDA website and cross-referencing it against your product catalogue is a sensible first compliance step.

Allergen Labelling as Part of FSMA Compliance

Allergen labelling sits at the intersection of FSMA preventive controls and FALCPA requirements, and for online food businesses, getting it right is non-negotiable. Under FALCPA and the FASTER Act of 2021, the nine major food allergens in the US — milk, eggs, fish, shellfish, tree nuts, wheat, peanuts, soybeans, and sesame — must be clearly declared on every packaged food label. Within a FSMA-compliant food safety plan, allergen controls are a required category of preventive controls for any facility that handles these ingredients, covering both the risk of undeclared allergens through mislabelling and the risk of allergen cross-contact during production.

For Shopify merchants selling food online, allergen information must appear not just on the physical product label but also in the product descriptions and information displayed to customers at the point of purchase. Consumers with food allergies are increasingly relying on online product information to make safe purchasing decisions, and providing accurate, up-to-date allergen data on your store is both a legal responsibility and a fundamental customer care obligation. Errors in your online allergen information can lead to serious harm, regulatory enforcement, and reputational damage that is very difficult to recover from in a direct-to-consumer market.

Managing allergen information accurately across a growing product catalogue is one of the most common operational challenges food businesses face as they scale on Shopify. Ingredients change, formulations are updated, and new products are added — each change creates a potential for allergen information to fall out of sync between your physical labels, your supplier specifications, and your online store. Ensure allergen compliance for your US food business's Shopify store with Allergen Matrix at saltai.app.

Working With the FDA as a Small Online Food Business

The FDA publishes a substantial library of guidance documents, small business resources, and compliance assistance materials specifically designed to help smaller food businesses navigate FSMA requirements without the resources of a large manufacturer. The FDA's Small Business Representative program and its network of food safety specialists can be contacted directly for guidance on which rules apply to your specific operation. Taking advantage of these resources proactively is a far better strategy than waiting for an inspection or enforcement action to prompt engagement with the agency. Most food safety specialists within the FDA are genuinely willing to help smaller operators understand their obligations.

State departments of agriculture and local health departments also play an important role in food safety oversight for small businesses, particularly those operating under cottage food exemptions or selling at farmers markets alongside their online channels. Understanding how your state-level obligations interact with federal FSMA requirements is important, because state rules can sometimes be more stringent than the federal baseline. Consulting with a food safety attorney or a Preventive Controls Qualified Individual when you are scaling up your online food business is an investment that typically pays for itself quickly in avoided compliance errors and greater operational confidence.

As your Shopify food business grows, building relationships with your FDA district office and staying current with FSMA guidance updates will serve you far better than a one-time compliance review. FSMA is a living regulatory framework that the FDA continues to implement and refine, and new guidance documents, industry letters, and rule amendments are published regularly. Subscribing to FDA food safety email updates and following relevant industry associations are practical ways to stay informed without dedicating excessive time to regulatory monitoring. Compliance is not a one-time project — it is an ongoing operational discipline that grows with your business.

Try Allergen Matrix free at saltai.app — no credit card required.